========================================================================
CVE-2026-110752                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110752

  Distribution:  Text-CSV_XS
      Versions:  before 1.65
      MetaCPAN:  https://metacpan.org/dist/Text-CSV_XS
      VCS Repo:  https://github.com/cpan-authors/Text-CSV_XS

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by
allocating one entry per index of an RFC 7111 selector in fragment

Description
-----------
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by
allocating one entry per index of an RFC 7111 selector in fragment.

fragment expands a row= or col= selector into an array with one element
per selected index before it reads any data, and it does not clamp an
explicit end column in a cell= selector to the row. Only the syntax and
order of the ranges are checked, so row=1-400000000 on a two-line file
allocates 400 million elements.

An application that passes a request-supplied fragment to fragment or
csv can be made to exhaust memory, which ends the process with an Out
of memory error that eval cannot catch.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to Text-CSV_XS 1.65 or later.

References
----------
https://github.com/cpan-authors/Text-CSV_XS/commit/d9d3d66f9ff6a8a1bc255a6ef05100f9b102b92b.patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes

Timeline
--------
- 2026-10-14: Fix committed to upstream repository.
- 2026-10-15: Version 1.65 released with fix.